3 ms·

1. Security is not some magical property of software created by large corporations. Neither are they perfectly secure, nor is it that hard to even write your ow

1. Security is not some magical property of software created by large corporations. Neither are they perfectly secure, nor is it that hard to even write your own secure mail server, alone. 2. They are by themselves a major security problem because they necessarily have access to all your email. And what's worse, if everyone is using them, they have access to everyone's email. That's a huge amount of power waiting to be abused, if not directly by them, by someone bribing them, putting pressure on them, or simply by infiltrating them.

sanderjd 10y ago
> Neither are they perfectly secure, nor is it that hard to even write your own secure mail server, alone. The first part of that may be true, but the second part is definitely false. It is very hard to write your own secure anything-connected-to-a-network.
- zAy0LfpBZLC8mAC 10y ago
  > The first part of that may be true, but the second part is definitely false. It is very hard to write your own secure anything-connected-to-a-network. No, it's not. Where did you get that idea?
  - sanderjd 10y ago
    From years of using, writing, and reading about network software. I'm not sure if you're being obstinate or naive, or if you actually have some silver bullet for writing secure network software, but if it's the latter, I'm sure lots of people would love to pick your brain!
    - zAy0LfpBZLC8mAC 10y ago
      There is no silver bullet, but one very helpful principle: Avoid complexity. But let me ask you: What are the big security problems that you see with a personal email server that you think are difficult to get right/to avoid?
      - sanderjd 10y ago
        All the same things that are difficult to get right in any other chunk of code that handles arbitrary input from across the internet. I have a couple tomes on this subject: "The Art of Software Security Assessment" is 1200 pages long, "The Web Application Hacker's Handbook" is another 900 pages. Nobody has solved all the issues discussed in those (and many other) books in such a way that makes this no longer "hard". Note that I'm not at all claiming this stuff is impossible or a total lost cause, just that I think it easily passes the bar for "hard", and is certainly tricky enough to get right that I personally don't think it's worth the effort to run network-connected services unless they're for a business that I'm hoping will pay for my time and effort somehow.
        zAy0LfpBZLC8mAC 10y ago
        > All the same things that are difficult to get right in any other chunk of code that handles arbitrary input from across the internet. That's about as unspecific as you can be, isn't it? So, let me give the equally uninformative answer: All of those are either easy to prevent, or they lead to a DoS, which isn't a big concern for a personal email server. > "The Art of Software Security Assessment" is 1200 pages long Haven't read it, but by its TOC, it's mostly irrelevant to the given problem (except maybe that it teaches you to not write you personal mail server in C, who would have thought ...). > "The Web Application Hacker's Handbook" is another 900 pages. Didn't I say something about avoiding complexity? No, you should not build your mail server as a web application, in case that wasn't clear. > Nobody has solved all the issues discussed in those (and many other) books in such a way that makes this no longer "hard". Well, how about you give an example of one problem that you think is still hard enough to be a major obstacle to implementing you own secure personal mail server? > [...] that I personally don't think it's worth the effort to run network-connected services unless they're for a business that I'm hoping will pay for my time and effort somehow. How is it that you suddenly switched to "services"? I thought we were talking about "network software"? Am I supposed to believe that you are not running a web browser unless it's for a business that you're hoping will pay for your time and effort somehow? How about web applications? Or what is your justification for a distinction between "services" and "network software", as far as possible security impact is concerned?
sirclueless 10y ago
Security is not "magical," no. In fact it's barely even a "property of software." Instead it's a property of a system. Some of the elements of this system are software. We can perhaps make some guarantees about the properties of this software, but these alone do not make the system secure (systems that are provably secure end-to-end are vanishingly rare, if they exist at all). Part of the system is configuration and data. What cryptographic keys and other systems do you trust, and how do you guarantee that trust? Part of the system is human process -- when a customer calls support, does someone give up private information or allow passwords to be reset? If the government knocks on the door of your cloud hosting provider, will they cooperate freely? When your linux distro announces a security issue to a trusted list ahead of a public announcement, do you have someone on that list ready to respond to the issue before your server is hit by a 0-day? There's a lot that goes into making a secure system. And there is considerable economy of scale -- a large company can afford to have 24/7 monitoring and issue escalation processes. You cannot.
- zAy0LfpBZLC8mAC 10y ago
  > We can perhaps make some guarantees about the properties of this software, but these alone do not make the system secure (systems that are provably secure end-to-end are vanishingly rare, if they exist at all). Which applies equally to gmail. > If the government knocks on the door of your cloud hosting provider, will they cooperate freely? Which applies equally to gmail. > When your linux distro announces a security issue to a trusted list ahead of a public announcement, do you have someone on that list ready to respond to the issue before your server is hit by a 0-day? Which can be automated. > There's a lot that goes into making a secure system. And there is considerable economy of scale -- a large company can afford to have 24/7 monitoring and issue escalation processes. You cannot. And you don't need to. If you don't need to do this with your email client, you also don't need to do this with your email server. Also, there is also a major economy of scale to compromising google instead of your personal email server. No, of course, there is no "perfect security" (whatever that is). And that's true for both gmail and self-hosting. But it is perfectly possible to write an email server that's very unlikely to be exploited surprisingly into remote code execution as a single developer.
basch 10y ago
time to action is a byproduct of awareness. if i run my own server by myself and am asleep, my reaction time to a security incident is severely limited by my sleepfulness.
- zAy0LfpBZLC8mAC 10y ago
  Except that you sleeping or not doesn't really change all that much whether you notice the security incident in the first place. It's not like you have some sixth sense for security incidents that just stops working while you are asleep, is it? And neither has Google. Or anyone. Now, if someone has been siphoning off your emails for months, does it matter whether you notice today or tomorrow? If you are talking about easy to detect abuses, such as participation in a DDoS attack, say: (1) those aren't really that bad for you, and if you fix them within 24 hours, not even for the attacked, and (2) your upstream provider might just notice and shut off your machine until you are awake if it's really bad. But with all that said: Neither of those is particularly likely to happen anyhow if you take care of installing updates in time. What gets owned are high-value targets, bad passwords, and machines with ancient software (as in: security update has been available for a few years), the latter two of which are trivial to avoid.

sanderjd 10y ago

> Neither are they perfectly secure, nor is it that hard to even write your own secure mail server, alone. The first part of that may be true, but the second part is definitely false. It is very hard to write your own secure anything-connected-to-a-network.

zAy0LfpBZLC8mAC 10y ago
> The first part of that may be true, but the second part is definitely false. It is very hard to write your own secure anything-connected-to-a-network. No, it's not. Where did you get that idea?
- sanderjd 10y ago
  From years of using, writing, and reading about network software. I'm not sure if you're being obstinate or naive, or if you actually have some silver bullet for writing secure network software, but if it's the latter, I'm sure lots of people would love to pick your brain!
  - zAy0LfpBZLC8mAC 10y ago
    There is no silver bullet, but one very helpful principle: Avoid complexity. But let me ask you: What are the big security problems that you see with a personal email server that you think are difficult to get right/to avoid?
    - sanderjd 10y ago
      All the same things that are difficult to get right in any other chunk of code that handles arbitrary input from across the internet. I have a couple tomes on this subject: "The Art of Software Security Assessment" is 1200 pages long, "The Web Application Hacker's Handbook" is another 900 pages. Nobody has solved all the issues discussed in those (and many other) books in such a way that makes this no longer "hard". Note that I'm not at all claiming this stuff is impossible or a total lost cause, just that I think it easily passes the bar for "hard", and is certainly tricky enough to get right that I personally don't think it's worth the effort to run network-connected services unless they're for a business that I'm hoping will pay for my time and effort somehow.
      - zAy0LfpBZLC8mAC 10y ago
        > All the same things that are difficult to get right in any other chunk of code that handles arbitrary input from across the internet. That's about as unspecific as you can be, isn't it? So, let me give the equally uninformative answer: All of those are either easy to prevent, or they lead to a DoS, which isn't a big concern for a personal email server. > "The Art of Software Security Assessment" is 1200 pages long Haven't read it, but by its TOC, it's mostly irrelevant to the given problem (except maybe that it teaches you to not write you personal mail server in C, who would have thought ...). > "The Web Application Hacker's Handbook" is another 900 pages. Didn't I say something about avoiding complexity? No, you should not build your mail server as a web application, in case that wasn't clear. > Nobody has solved all the issues discussed in those (and many other) books in such a way that makes this no longer "hard". Well, how about you give an example of one problem that you think is still hard enough to be a major obstacle to implementing you own secure personal mail server? > [...] that I personally don't think it's worth the effort to run network-connected services unless they're for a business that I'm hoping will pay for my time and effort somehow. How is it that you suddenly switched to "services"? I thought we were talking about "network software"? Am I supposed to believe that you are not running a web browser unless it's for a business that you're hoping will pay for your time and effort somehow? How about web applications? Or what is your justification for a distinction between "services" and "network software", as far as possible security impact is concerned?

sirclueless 10y ago

Security is not "magical," no. In fact it's barely even a "property of software." Instead it's a property of a system. Some of the elements of this system are software. We can perhaps make some guarantees about the properties of this software, but these alone do not make the system secure (systems that are provably secure end-to-end are vanishingly rare, if they exist at all). Part of the system is configuration and data. What cryptographic keys and other systems do you trust, and how do you guarantee that trust? Part of the system is human process -- when a customer calls support, does someone give up private information or allow passwords to be reset? If the government knocks on the door of your cloud hosting provider, will they cooperate freely? When your linux distro announces a security issue to a trusted list ahead of a public announcement, do you have someone on that list ready to respond to the issue before your server is hit by a 0-day? There's a lot that goes into making a secure system. And there is considerable economy of scale -- a large company can afford to have 24/7 monitoring and issue escalation processes. You cannot.

zAy0LfpBZLC8mAC 10y ago
> We can perhaps make some guarantees about the properties of this software, but these alone do not make the system secure (systems that are provably secure end-to-end are vanishingly rare, if they exist at all). Which applies equally to gmail. > If the government knocks on the door of your cloud hosting provider, will they cooperate freely? Which applies equally to gmail. > When your linux distro announces a security issue to a trusted list ahead of a public announcement, do you have someone on that list ready to respond to the issue before your server is hit by a 0-day? Which can be automated. > There's a lot that goes into making a secure system. And there is considerable economy of scale -- a large company can afford to have 24/7 monitoring and issue escalation processes. You cannot. And you don't need to. If you don't need to do this with your email client, you also don't need to do this with your email server. Also, there is also a major economy of scale to compromising google instead of your personal email server. No, of course, there is no "perfect security" (whatever that is). And that's true for both gmail and self-hosting. But it is perfectly possible to write an email server that's very unlikely to be exploited surprisingly into remote code execution as a single developer.

basch 10y ago

time to action is a byproduct of awareness. if i run my own server by myself and am asleep, my reaction time to a security incident is severely limited by my sleepfulness.

zAy0LfpBZLC8mAC 10y ago
Except that you sleeping or not doesn't really change all that much whether you notice the security incident in the first place. It's not like you have some sixth sense for security incidents that just stops working while you are asleep, is it? And neither has Google. Or anyone. Now, if someone has been siphoning off your emails for months, does it matter whether you notice today or tomorrow? If you are talking about easy to detect abuses, such as participation in a DDoS attack, say: (1) those aren't really that bad for you, and if you fix them within 24 hours, not even for the attacked, and (2) your upstream provider might just notice and shut off your machine until you are awake if it's really bad. But with all that said: Neither of those is particularly likely to happen anyhow if you take care of installing updates in time. What gets owned are high-value targets, bad passwords, and machines with ancient software (as in: security update has been available for a few years), the latter two of which are trivial to avoid.